OT: patch those windows systems

[Technician]

In article <[email protected]>, [email protected] says...
> Technician wrote:
>
> >>My FTP servers often get hit with anonymous connections - they're just kiddies looking for open
> >>servers where they can dump warez, etc.
> >
> >
> > Could be interesting. just have to write a script that takes a win32 virus/worm/trojan
> > (preferably one that is really nasty and hard to detect), grabs the files in the "uploads"
> > directory, injects the virus/worm/trojan into the files, and places them in the "just_uploaded"
> > folder and then deletes the original "clean" file. it may not stop the warez problem, but at
> > least it will wreak havoc with their systems for a while, and thus providing and form of cheap
> > entertainment. silent backdoors are always fun (if only i had a few to toy with).
>
> You're getting in to dodgy territory with virii. If you want to do something like that, look at
> honeypots.

I already looked into it and i don't have a spare PC to use.

>
>
> >>As for general security tips, turn off any unwanted services, install some decent IPTables rules
> >>and keep up to date with exploits by subscribing to security mailing lists or newsgroups.
> >>
> >
> > I have turned off all services that i can, and blocked ports for the others. the only ports that
> > are open that i can detect from the outside are 21 (FTP), 22 (SSH), 25 (SMTP), 80 (HTTP), 110
> > (POP3), 119 (NNTP), and 443 (HTTPS).
> >
> > FTP does not allow anonymous access. SMTP only relays for internal hosts, and only receives
> > mail for this domain. HTTP is as secure as http can be. POP3 is just the inetd pop3 daemon.
> > would like to change to something i can actually configure. NNTP is userassword protected and
> > only provides access to local groups only (such as server news and user created groups and so
> > forth). HTTPS is fairly secure as it uses my own certificate generated from a nice source of
> > random data.
>
> If you collect mail with SMTP, why are you running POP3?
>
>

Gotta check email somehow (from a different computer). The alternativee is to log in via SSH and run
Pine to check mail. keep in mind, root never connects to pop3. root mail is forwarded to my account,
and then i check that account (my account has very low in the security food chain, the home
directory is in fact completely empty and shell access is blocked).

I am running a IDS so i can pick up at least the more common detectable attacks, And i monitor the
system logs for any suspicious activity.

I may not be a full network security guru, but i at least know some of the basics.

~Travis
--
To reply by email, remove clothes.

travis5765.homelinux.net, Primary Administrator TF Custom Electronic, Owner/Founder/Developer
(current project: Automotive exhaust flame-thrower)

 

[Bomba]

Technician wrote:

> I am running a IDS so i can pick up at least the more common detectable attacks, And i monitor the
> system logs for any suspicious activity.

If you're running Snort, make sure you've upgraded to the latest version
(2..0). There are multiple vulnerabilities with the preprocessors in
3.8 - 1.9.1.

> I may not be a full network security guru, but i at least know some of the basics.

My advice would be to keep on reading. Ingest as much information as you can and then put it in to
practice. Sounds like you're doing ok though

--
a.m-b FAQ: http://www.t-online.de/~jharris/ambfaq.htm

b.bmx FAQ: http://www.t-online.de/~jharris/bmx_faq.htm

 

[Shaun Rimmer]

Technician <[email protected]> wrote in message
news:[email protected]...

> Humorous reference to AMD processors at http://www.chasten.org/hacker.htm <quote> If your son has
> requested a new "processor" from a company called "AMD", this is genuine cause for alarm. AMD is a
> third-world based company who make inferior, "knock-off" copies of American processor chips. They
> use child labor extensively in their third world sweatshops, and they deliberately disable the
> security features that American processor makers, such as Intel, use to prevent hacking. AMD chips
> are never sold in stores, and you will most likely be told that you have to order them from
> internet sites. Do not buy this chip! This is one request that you must refuse your son, if you
> are to have any hope of raising him well. </quote> ;-)

Humorous? My ****! - It's just an out-and-out lie! Everyone knows AMD **** all over Intel!

Shaun aRe - It's all in the architecture or summink.......

 

[Sorni]

"bomba" <[email protected]> wrote in message news:[email protected]...
> Technician wrote:
>
> > I am running a IDS so i can pick up at least the more common detectable attacks, And i monitor
> > the system logs for any suspicious activity.
>
> If you're running Snort, make sure you've upgraded to the latest version
> (2..0).

OK, now you're just making up names and stuff. Snort-snort...

Bill "running multiple Pillbox Redhats on Fishnet Stockings" S.

 

[Technician]

In article <[email protected]>, [email protected] says...
> Technician wrote:
>
> > I am running a IDS so i can pick up at least the more common detectable attacks, And i monitor
> > the system logs for any suspicious activity.
>
> If you're running Snort, make sure you've upgraded to the latest version
> (2..0). There are multiple vulnerabilities with the preprocessors in
> 1.8 - 1.9.1.
>

Figures, snort v1.9.1. i'll download the latest now. thanks for the heads up (i left the mailing
list as it filled up my email too fast).

> > I may not be a full network security guru, but i at least know some of the basics.
>
> My advice would be to keep on reading. Ingest as much information as you can and then put it in to
> practice. Sounds like you're doing ok though
>
>

Well, i figure that just one Linux system compromise in, well, my entire life, is fairly good. But
then, it is not exactly a high availability setup, nor is it a high profile (i wonder how many
attempted attacks www.nsa.gov gets).

My plans for the future, should funding allow it, is to off-load internet access to a specific
router that uses a read-only, network boot OS (slightly harder to compromise IMO). then to have
another system who's only purpose is to bridge from the router to the LAN and be a firewall, as well
as a dual IDS (inside and outside of the firewall).

Both the firewall and router will be locked from remote login (terminal access only). though it
would be nice to have a remote connection manager (for the dial-up/disconnect, and status, speed,
etc...), though i have not found one. i fear i will have to program it myself. But then, i have yet
to get my current router (my server is currently an all-in- one, though internet access is via an,
uggg, WinXP system) to actually route internet packets. currently, it seems to function as a gateway
(default route is set to the WinXP box), but when i change it over to dial-up (in other words,
remove the default gateway and connect), only the server has internet access. i can post the route
tables if needed (normal, and during a dial-up connection).

I have compiled a bridge enabled kernel, but it seems to fail to bridge the connections so i kind of
gave up on that for a while.

At the moment, the server has 3 ethernet cards (eth0 - 192.168.0.2, eth1
- 192.168.1.1, eth2 - 192.168.2.1). as i have only two hubs, this method seemed to work for my
needs. eth1 is a spare connection, eth2 is for my palm computer. it works well, and for internet i
just fired up Squid (a proxy server for those who don't know) so my palm computer has internet
access, as well as ethernet access at the blazing speed of an RS232 connection (have a Portsmith
ethernet to serial converter that i plug the palm into via a serial hotsync cable). eth0 is
connected to the hub that links the LAN together, and that hub is uplinked to another hub (the
source of many a collision) for the lower part of the house.

~Travis
--
To reply by email, remove clothes.

travis5765.homelinux.net, Primary Administrator TF Custom Electronic, Owner/Founder/Developer
(current project: Automotive exhaust flame-thrower)

 

[Technician]

In article <[email protected]>, [email protected] says...
>
> Technician <[email protected]> wrote in message
> news:[email protected]...
>
> > Humorous reference to AMD processors at http://www.chasten.org/hacker.htm <quote> If your son
> > has requested a new "processor" from a company called "AMD", this is genuine cause for alarm.
> > AMD is a third-world based company who make inferior, "knock-off" copies of American processor
> > chips. They use child labor extensively in their third world sweatshops, and they deliberately
> > disable the security features that American processor makers, such as Intel, use to prevent
> > hacking. AMD chips are never sold in stores, and you will most likely be told that you have to
> > order them from internet sites. Do not buy this chip! This is one request that you must refuse
> > your son, if you are to have any hope of raising him well. </quote> ;-)
>
> Humorous? My ****! - It's just an out-and-out lie! Everyone knows AMD **** all over Intel!
>
>
> Shaun aRe - It's all in the architecture or summink.......
>
>
>
>

Well, at least to me it is humorous because the guy is so friggin un- educated about computers that
he only serves to make an ass of himself.

I think #8 is particularly funny. I mean, first of all, Debian and Mandrake are distributions of
_Linux_ not Lunix, and his name is Linus Torvalds, not "Linyos Torovoltos". and second, BSD has
nothing to do with Linux or Linus. And last i checked, Linus was from Finland.

"If you see the word "LILO" during your windows startup (just after you turn the machine on), your
son has installed lunix. In order to get rid of it, you will have to send your computer back to the
manufacturer, and have them fit a new hard drive. Lunix is extremely dangerous software, and cannot
be removed without destroying part of your hard disk surface."

Actually, just pop in a windows boot disk, run fdisk /mbr to remove lilo, then remove the linux
partitions.

All-in-all, this guy needs a swift kick in the but.

~Travis
--
To reply by email, remove clothes.

travis5765.homelinux.net, Primary Administrator TF Custom Electronic, Owner/Founder/Developer
(current project: Automotive exhaust flame-thrower)

 

[Technician]

In article <[email protected]>, [email protected] says...
>
> "bomba" <[email protected]> wrote in message news:[email protected]...
> > Technician wrote:
> >
> > > I am running a IDS so i can pick up at least the more common detectable attacks, And i monitor
> > > the system logs for any suspicious activity.
> >
> > If you're running Snort, make sure you've upgraded to the latest version
> > (2..0).
>
> OK, now you're just making up names and stuff. Snort-snort...

Not sure if you are kidding or not... (though the pun at the end should give it away) www.snort.org

~Travis
--
To reply by email, remove clothes.

travis5765.homelinux.net, Primary Administrator TF Custom Electronic, Owner/Founder/Developer
(current project: Automotive exhaust flame-thrower)

 

[Bomba]

Technician wrote:

> All-in-all, this guy needs a swift kick in the but.

It's a parody, a hoax, a joke...

 

[Technician]

In article <[email protected]>, myarse247 @hotmail.com says...
> Technician wrote:
>
> > All-in-all, this guy needs a swift kick in the but.
>
> It's a parody, a hoax, a joke...
>
>

Yeah, but still...

~Travis
--
To reply by email, remove clothes.

travis5765.homelinux.net, Primary Administrator TF Custom Electronic, Owner/Founder/Developer
(current project: Automotive exhaust flame-thrower)

 

[The Ogre]

bomba <[email protected]> wrote in message news:<[email protected]>...
> Technician wrote:
>
> > It is a default of the windows installation, only if you know enough to do the custom install do
> > you find a place to not install IIS.
>
> Not true. Win 2K Server / Advanced Server install IIS by default, but not Win 2K Pro - you have to
> deliberately install IIS on Pro.

Not to mention that anyone who sets up an operating system using the defaults is an idiot.
Unfortunately that describes the vast majority of systems administrators. Several of the Linux
distributions (Gentoo & Slackware come to mind) make you manually turn on every single service you
want to use. I think this is far superior to the RedHat/ Microsoft way of activating everything by
default. This way the idiots just have a broken server which is incapable of being a conduit for
nastiness.

> As for general security tips, turn off any unwanted services, install some decent IPTables rules
> and keep up to date with exploits by subscribing to security mailing lists or newsgroups.

Although I don't use MS based software Windows Servers are secured similarly. The difference is that
there are more idiots who know how to install Windows than Linux. The balance is shifting and the
number of idiots who can intall Linux is on the rise though.

-- The Ogre http://ogrehut.com

 

[Bomba]

Technician wrote:

> Figures, snort v1.9.1. i'll download the latest now. thanks for the heads up (i left the mailing
> list as it filled up my email too fast).

Try signing up to something like the SANS mailing lists - they come through once or twice a week
with all the security news and latest vulnerabilities.

>>>I may not be a full network security guru, but i at least know some of the basics.
>>
>>My advice would be to keep on reading. Ingest as much information as you can and then put it in to
>>practice. Sounds like you're doing ok though
>>
>
> Well, i figure that just one Linux system compromise in, well, my entire life, is fairly good. But
> then, it is not exactly a high availability setup, nor is it a high profile (i wonder how many
> attempted attacks www.nsa.gov gets).

You're looking at it the wrong way. Most cracking is the result of skiddies with root kits - they
don't care who they hit. And unless you're very, very good with a large chip on your shoulder, why
would you want to take on the NSA?

> My plans for the future, should funding allow it, is to off-load internet access to a specific
> router that uses a read-only, network boot OS (slightly harder to compromise IMO). then to have
> another system who's only purpose is to bridge from the router to the LAN and be a firewall, as
> well as a dual IDS (inside and outside of the firewall).

Slightly OTT, IMO. Most home LANs just need a masquerading router / firewall. Also, there's little
point in having an external IDS except for interest purposes.

> Both the firewall and router will be locked from remote login (terminal access only). though it
> would be nice to have a remote connection manager (for the dial-up/disconnect, and status, speed,
> etc...), though i have not found one. i fear i will have to program it myself.

Firstly, terminal access is a little extreme. Why not run SSH, block root connections, connect with
your user and then su to root? This should be more than secure enough.

But then,
> i have yet to get my current router (my server is currently an all-in- one, though internet access
> is via an, uggg, WinXP system) to actually route internet packets. currently, it seems to function
> as a gateway (default route is set to the WinXP box), but when i change it over to dial-up (in
> other words, remove the default gateway and connect), only the server has internet access. i can
> post the route tables if needed (normal, and during a dial-up connection).

If I'm reading correctly, it sounds like you need to either sort out your topology or NAT /
masquerading.

--
a.m-b FAQ: http://www.t-online.de/~jharris/ambfaq.htm

b.bmx FAQ: http://www.t-online.de/~jharris/bmx_faq.htm